PT-2025-49322 · Dropbox+5 · Dropbox+5

Published 2025-12-05 · Updated 2025-12-09 · CVE-2025-66629

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.10.4

Description HedgeDoc is a real-time, collaborative, markdown notes application. Certain OAuth2 endpoints used for social login providers—including Google, GitHub, GitLab, Facebook, and Dropbox—did not include CSRF protection. Specifically, these endpoints lacked a state parameter and verification of the response using this parameter. This could allow attackers to potentially hijack user authentication sessions.

Recommendations Update to version 1.10.4 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-66629

GHSA-6WM6-3VPQ-6QVV

Affected Products

Dropbox

Facebook

Github

Gitlab

Google

Hedgedoc

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66629.json · Exploit
• https://github.com/hedgedoc/hedgedoc/commit/35f36fccba941ed8029ee222f7d2a5df17b42e2b · Patch
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6wm6-3vpq-6qvv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66629 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66629 · Vendor Advisory
• https://t.me/cveNotify/144973 · Telegram Post
• https://t.me/CVEtracker/38973 · Telegram Post
• https://t.me/cveNotify/145230 · Telegram Post
• https://twitter.com/CVEnew/status/1997082608392396996 · Twitter Post